// server and is under a configured base DN.
		validatedParent, isUnderBaseDN, err := sys.LDAPConfig.GetValidatedUserDN(conn, parent)
		if err != nil {
			collectedErrors = append(collectedErrors, fmt.Errorf("could not validate parent exists in LDAP directory: %w", err))
			continue
		}
		if validatedParent == nil || !isUnderBaseDN {
			skippedAccessKeys = append(skippedAccessKeys, ak)
			continue
		}

      // e.g. a certificate pinning error.
      return false
    }
    // An example of one we might want to retry with a different route is a problem connecting to a
    // proxy and would manifest as a standard IOException. Unless it is one we know we should not
    // retry, we return true and try a new route.
    return true
  }

  /**

to take advantage of sweet Kotlin features.

#### Credentials.basic()

The username and password parameters to `Credentials.basic()` are now non-null strings. In OkHttp
3.x, null would yield a username or password of "null".

#### HttpUrl.queryParameterValues()

The return type of `HttpUrl.queryParameterValues()` is `List<String?>`. Lists that may contain null

		if f.ModifiedTime != 0 || f.ModifiedDate != 0 {
			f.Modified = modified.In(timeZone(msdosModified.Sub(modified)))
		}
	}

	// Assume that uncompressed size 2³²-1 could plausibly happen in
	// an old zip32 file that was sharding inputs into the largest chunks
	// possible (or is just malicious; search the web for 42.zip).
	// If needUSize is true still, it means we didn't see a zip64 extension.

 * descriptor ACEs:
 * 
 * <pre>
 * Allow WNET\alice     0x001200A9  Direct
 * Allow Administrators 0x001F01FF  Inherited
 * Allow SYSTEM         0x001F01FF  Inherited
 * </pre>
 * 
 * the access check would fail because the direct ACE has an access mask
 * of <tt>0x001200A9</tt> which doesn't have the
 * <tt>FILE_WRITE_DATA</tt> bit on (bit <tt>0x00000002</tt>). Actually, this isn't quite correct. If

        Exception ex0 = null;

        try {
            /* We cannot synchronize (run_thread) here or the caller's
             * thread.wait( timeout ) cannot reaquire the lock and
             * return which would render the timeout effectively useless.
             */
            doConnect();
        } catch( Exception ex ) {
            ex0 = ex; // Defer to below where we're locked
            return;
        } finally {

# use the wheel's TensorFlow installation instead of the one made available
# through bazel. This must be done in a different root directory, //bazel_pip/...,
# because "import tensorflow" run from the root directory would instead import
# the folder instead of the venv package.
# 
# Pass --config=pip to run the same suite of tests. If you want to run just one
# test for investigation, you'll need --config=pip_venv instead, and then you

			"#define A",
			"#ifdef A",
			"#ifdef B",
			"#define C 1234",
			"#else",
			"#define C 5678",
			"#endif",
			"#endif",
			"C",
		),
		"5678.\n",
	},
	{
		"nested not-taken/would-be-taken #ifdef",
		lines(
			"#define B",
			"#ifdef A",
			"#ifdef B",
			"#define C 1234",
			"#else",
			"#define C 5678",
			"#endif",
			"#endif",
			"C",
		),
		"C.\n",
	},

  // ObjectSelector decides whether to run the validation based on if the
  // object has matching labels. objectSelector is evaluated against both
  // the oldObject and newObject that would be sent to the cel validation, and
  // is considered to match if either object matches the selector. A null
  // object (oldObject in the case of create, or newObject in the case of

   *
   * @since 30.0
   */
  @J2ktIncompatible
  @GwtIncompatible // concurrency
  public static void awaitTerminationUninterruptibly(ExecutorService executor) {
    // TODO(cpovirk): We could optimize this to avoid calling nanoTime() at all.
    verify(awaitTerminationUninterruptibly(executor, Long.MAX_VALUE, NANOSECONDS));
  }

  /**